diff --git a/.gitignore b/.gitignore
index 7b7e66e..4f22d91 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,7 +3,13 @@
 
 # leaving in preSH.tar.gz for anyone who's interested
 # in how NOT to do compression
-code.tar
+work.tar
+work
+work/
+work/*
+work/*/
+work/*/*
+work/*/*/
+work/*/*/*
 inst.lua
 com2/code.tar.bd
-
diff --git a/code.tar b/code.tar
new file mode 100644
index 0000000..0216243
Binary files /dev/null and b/code.tar differ
diff --git a/code/apps/sys-everest.lua b/code/apps/sys-everest.lua
index 28ecd1f..8ecb34e 100644
--- a/code/apps/sys-everest.lua
+++ b/code/apps/sys-everest.lua
@@ -26,19 +26,15 @@
 --     or this is a screensaver host, and has a saving-throw to start Bristol if it dies unexpectedly.
 --    In any case, this eventually returns to 2 or 4.
 
-local everestProvider = neo.requestAccess("r.neo.pub.window")
+local everestProvider = neo.requestAccess("r.neo.pub.window", "registering npw")
 if not everestProvider then return end
 
-local everestSessionProvider = neo.requestAccess("r.neo.sys.session")
-if not everestSessionProvider then return end
+local everestSessionProvider = neo.requireAccess("r.neo.sys.session", "registering nsse")
 
 -- Got mutexes. Now setup saving throw and shutdown callback
 -- Something to note is that Donkonit is the safety net on this,
 --  as it auto-releases the monitors.
-local screens = neo.requestAccess("x.neo.sys.screens")
-if not screens then
- error("Donkonit is required to run Everest")
-end
+local screens = neo.requireAccess("x.neo.sys.screens", "access to screens")
 
 neo.requestAccess("s.h.clipboard")
 neo.requestAccess("s.h.touch")
@@ -51,7 +47,7 @@ local monitors = {}
 
 -- NULL VIRTUAL MONITOR!
 -- This is where we stuff processes while Bristol isn't online
-monitors[0] = {nil, nil, 80, 25}
+monitors[0] = {nil, nil, 160, 50}
 
 -- {monitor, x, y, w, h, callback}
 -- callback events are:
@@ -116,6 +112,23 @@ local function monitorGPUColours(m, cb, bg, fg)
  end
 end
 
+-- Status line at top of screen
+local statusLine = nil
+
+local function doBackgroundLine(m, mg, bdx, bdy, bdl)
+ if statusLine and (bdy == 1) then
+  -- Status bar
+  monitorGPUColours(m, mg, 0x000000, 0xFFFFFF)
+  local str = unicode.sub(statusLine, bdx, bdx + bdl - 1)
+  local strl = unicode.len(str)
+  mg.set(bdx, bdy, unicode.undoSafeTextFormat(str))
+  mg.fill(bdx + strl, bdy, bdl - strl, 1, " ")
+ else
+  monitorGPUColours(m, mg, 0x000020, 0)
+  mg.fill(bdx, bdy, bdl, 1, " ")
+ end
+end
+
 local function updateRegion(monitorId, x, y, w, h, surfaceSpanCache)
  if not renderingAllowed() then return end
  local m = monitors[monitorId]
@@ -131,21 +144,21 @@ local function updateRegion(monitorId, x, y, w, h, surfaceSpanCache)
  -- this, in combination with 'forcefully blank out last column of window during render',
  -- cleans up littering
  w = w + 1
- -- end
+ -- WCHAX: end
 
  for span = 1, h do
   local backgroundMarkStart = nil
   for sx = 1, w do
    local t, tx, ty = surfaceAt(monitorId, sx + x - 1, span + y - 1)
    if t then
-    -- It has to be in this order to get rid of wide char weirdness
+    -- Background must occur first due to wide char weirdness
     if backgroundMarkStart then
-     monitorGPUColours(m, mg, 0x000020, 0)
-     mg.fill(backgroundMarkStart + x - 1, span + y - 1, sx - backgroundMarkStart, 1, " ")
+     local bdx, bdy, bdl = backgroundMarkStart + x - 1, span + y - 1, sx - backgroundMarkStart
+     doBackgroundLine(m, mg, bdx, bdy, bdl)
      backgroundMarkStart = nil
     end
-    if not surfaceSpanCache[t .. "_" .. ty] then
-     surfaceSpanCache[t .. "_" .. ty] = true
+    if not surfaceSpanCache[monitorId .. t .. "_" .. ty] then
+     surfaceSpanCache[monitorId .. t .. "_" .. ty] = true
      surfaces[t][6]("line", ty)
     end
    elseif not backgroundMarkStart then
@@ -153,13 +166,26 @@ local function updateRegion(monitorId, x, y, w, h, surfaceSpanCache)
    end
   end
   if backgroundMarkStart then
-   local m = monitors[monitorId]
-   monitorGPUColours(m, mg, 0x000020, 0)
-   mg.fill(backgroundMarkStart + x - 1, span + y - 1, (w - backgroundMarkStart) + 1, 1, " ")
+   doBackgroundLine(monitors[monitorId], mg, backgroundMarkStart + x - 1, span + y - 1, (w - backgroundMarkStart) + 1)
   end
  end
 end
 
+local function updateStatus()
+ statusLine = "Λ-¶: menu, ◣-Λ-C: Session hardkill"
+ if surfaces[1] then
+  if #monitors > 1 then
+   statusLine = "Λ-＋: move, Λ-Z: switch, Λ-X: swMonitor"
+  else
+   statusLine = "Λ-＋: move, Λ-Z: switch"
+  end
+ end
+ statusLine = unicode.safeTextFormat(statusLine)
+ for k, v in ipairs(monitors) do
+  updateRegion(k, 1, 1, v[3], 1, {})
+ end
+end
+
 local function ensureOnscreen(monitor, x, y, w, h)
  if monitor <= 0 then monitor = #monitors end
  if monitor >= (#monitors + 1) then monitor = 1 end
@@ -185,6 +211,7 @@ local function reconcileAll()
   v[6] = -1
   updateRegion(k, 1, 1, v[3], v[4], {})
  end
+ updateStatus()
 end
 
 local function moveSurface(surface, m, x, y, w, h)
@@ -305,6 +332,7 @@ local function changeFocus(oldSurface, optcache)
   if ns1 then
    ns1[6]("focus", true)
   end
+  updateStatus()
   if oldSurface then
    updateRegion(oldSurface[1], oldSurface[2], oldSurface[3], oldSurface[4], oldSurface[5], optcache)
   end
diff --git a/code/apps/sys-init.lua b/code/apps/sys-init.lua
index 5dce2f7..6d07ed5 100644
--- a/code/apps/sys-init.lua
+++ b/code/apps/sys-init.lua
@@ -281,31 +281,6 @@ end
 
 local function initializeSystem()
  -- System has just booted, bristol is in charge
- -- IMMEDIATELY install security policy in a TSR-like manner,
- --  using root privs to keep it going when sys-init's not around
- local rootAccess = neo.requireAccess("k.root", "installing security (YOU SHOULD NEVER SEE THIS)")
- rootAccess.securityPolicy = function (pid, proc, req)
-  req.result = proc.pkg:sub(1, 4) == "sys-"
-  local secpol, err = require("sys-secpolicy")
-  if not secpol then
-   -- Failsafe.
-   neo.emergency("Used fallback policy because of load-err: " .. err)
-   req.service()
-  end
-  local settings
-  pcall(function ()
-   -- basically pull system settings from thin air
-   settings = rootAccess.retrieveAccess("x.neo.sys.manage", "sys-init", -1)
-  end)
-  local ok, err = pcall(secpol, nil, settings, proc.pkg, pid, req.perm, function (r)
-   req.result = r
-   req.service()
-  end)
-  if not ok then
-   neo.emergency("Used fallback policy because of run-err: " .. err)
-   req.service()
-  end
- end
  -- Firstly, initialize hardware to something sensible since we don't know scrcfg
  gpu = neo.requestAccess("c.gpu").list()()
  if gpu then
diff --git a/code/data/app-claw/local.lua b/code/data/app-claw/local.lua
new file mode 100644
index 0000000..d71ddd7
--- /dev/null
+++ b/code/data/app-claw/local.lua
@@ -0,0 +1,156 @@
+return {
+ ["neo"] = {
+  desc = "KittenOS NEO Kernel & Base Libs",
+  v = 0,
+  app = false,
+  deps = {
+  },
+  dirs = {
+   "apps",
+   "libs",
+   "data"
+  },
+  files = {
+   "init.lua",
+   "libs/event.lua",
+   "libs/serial.lua",
+   "libs/neoux.lua",
+   "libs/sys-filewrap.lua"
+  },
+ },
+ ["neo-init"] = {
+  desc = "KittenOS NEO / sys-init (startup)",
+  v = 0,
+  app = "app-launcher",
+  deps = {
+   "neo",
+   "neo-glacier",
+   "neo-icecap",
+   "neo-everest"
+  },
+  dirs = {
+   "apps"
+  },
+  files = {
+   "apps/sys-init.lua"
+  },
+ },
+ ["neo-launcher"] = {
+  desc = "KittenOS NEO / Default app-launcher",
+  v = 0,
+  app = "app-launcher",
+  deps = {
+   "neo"
+  },
+  dirs = {
+   "apps"
+  },
+  files = {
+   "apps/app-launcher.lua"
+  },
+ },
+ ["neo-everest"] = {
+  desc = "KittenOS NEO / Everest (settings & monitor management)",
+  v = 0,
+  app = "sys-everest",
+  deps = {
+   "neo"
+  },
+  dirs = {
+   "apps",
+  },
+  files = {
+   "apps/sys-everest.lua"
+  },
+ },
+ ["neo-icecap"] = {
+  desc = "KittenOS NEO / Icecap",
+  v = 0,
+  app = "sys-icecap",
+  deps = {
+   "neo"
+  },
+  dirs = {
+   "libs",
+   "apps"
+  },
+  files = {
+   "libs/sys-filevfs.lua",
+   "libs/sys-filedialog.lua",
+   "apps/sys-icecap.lua",
+   "apps/app-fm.lua"
+  },
+ },
+ ["neo-glacier"] = {
+  desc = "KittenOS NEO / Glacier (settings & monitor management)",
+  v = 0,
+  app = "sys-glacier",
+  deps = {
+   "neo"
+  },
+  dirs = {
+   "apps"
+  },
+  files = {
+   "apps/sys-glacier.lua"
+  },
+ },
+ ["app-textedit"] = {
+  desc = "KittenOS NEO Text Editor (Neolithic)",
+  v = 0,
+  app = "app-textedit",
+  deps = {
+   "neo"
+  },
+  dirs = {
+   "apps"
+  },
+  files = {
+   "apps/app-textedit.lua"
+  },
+ },
+ ["app-pass"] = {
+  desc = "KittenOS NEO Password Setter & Logout",
+  v = 0,
+  app = "app-pass",
+  deps = {
+   "neo"
+  },
+  dirs = {
+   "apps"
+  },
+  files = {
+   "apps/app-pass.lua"
+  },
+ },
+ ["app-taskmgr"] = {
+  desc = "KittenOS NEO Task Manager",
+  v = 0,
+  app = "app-taskmgr",
+  deps = {
+   "neo"
+  },
+  dirs = {
+   "apps"
+  },
+  files = {
+   "apps/app-taskmgr.lua"
+  },
+ },
+ ["app-claw"] = {
+  desc = "KittenOS NEO Package Manager",
+  v = 0,
+  app = "app-claw",
+  deps = {
+   "neo"
+  },
+  dirs = {
+   "apps",
+   "libs"
+  },
+  files = {
+   "apps/app-claw.lua",
+   "libs/claw.lua"
+  },
+ }
+}
diff --git a/code/init.lua b/code/init.lua
index 51953e1..abd0649 100644
--- a/code/init.lua
+++ b/code/init.lua
@@ -333,8 +333,8 @@ end
 -- These two are hooks for k.root level applications to change policy.
 -- Only a k.root application is allowed to do this for obvious reasons.
 function securityPolicy(pid, proc, req)
- -- Important safety measure : only sys-init gets anything until sys-init decides what to do.
- req.result = proc.pkg == "sys-init"
+ -- Important safety measure : only sys-* gets anything at first
+ req.result = proc.pkg:sub(1, 4) == "sys-"
  req.service()
 end
 function runProgramPolicy(ipkg, pkg, pid, ...)
diff --git a/code/libs/claw.lua b/code/libs/claw.lua
new file mode 100644
index 0000000..9da6fd9
--- /dev/null
+++ b/code/libs/claw.lua
@@ -0,0 +1,4 @@
+-- This is released into the public domain.
+-- No warranty is provided, implied or otherwise.
+
+-- claw: assistant to app-claw
diff --git a/code/libs/sys-filevfs.lua b/code/libs/sys-filevfs.lua
index 3e90ea4..ef01630 100644
--- a/code/libs/sys-filevfs.lua
+++ b/code/libs/sys-filevfs.lua
@@ -88,15 +88,17 @@ getFsNode = function (fs, parent, fsc, path, mode)
     if confirmedDel then
      delText = "Delete <ARMED>"
     end
-    n[#n + 1] = {delText, function ()
-     if not confirmedDel then
-      confirmedDel = true
-      return nil, t
-     end
-     fsc.remove(path)
-     return nil, dialog("Done.", parent)
-    end}
-    n[#n + 1] = {"Mk. Directory", function ()
+    if path ~= "/" then
+     table.insert(n, {delText, function ()
+      if not confirmedDel then
+       confirmedDel = true
+       return nil, t
+      end
+      fsc.remove(path)
+      return nil, dialog("Done.", parent)
+     end})
+    end
+    table.insert(n, {"Mk. Directory", function ()
      return nil, {
       name = "MKDIR...",
       list = function () return {} end,
@@ -106,7 +108,7 @@ getFsNode = function (fs, parent, fsc, path, mode)
        return nil, dialog("Done!", t)
       end
      }
-    end}
+    end})
     return n
    end,
    unknownAvailable = mode ~= nil,
diff --git a/imitclaw.lua b/imitclaw.lua
new file mode 100644
index 0000000..bf1612c
--- /dev/null
+++ b/imitclaw.lua
@@ -0,0 +1,35 @@
+-- This is released into the public domain.
+-- No warranty is provided, implied or otherwise.
+
+-- Imitation CLAW
+local done = {}
+
+local f, e = loadfile("code/data/app-claw/local.lua")
+if not f then error(e) end
+f = f()
+if not os.execute("mkdir work") then
+ error("Delete 'work'")
+end
+for k, v in pairs(f) do
+ for _, vd in ipairs(v.dirs) do
+  os.execute("mkdir work/" .. vd .. " 2> /dev/null")
+ end
+ for _, vf in ipairs(v.files) do
+  -- not totally proofed but will do
+  if not os.execute("cp code/" .. vf .. " work/" .. vf) then
+   error("Could not copy " .. vf .. " in " .. k)
+  end
+  if done[vf] then
+   error("duplicate " .. vf .. " in " .. k)
+  end
+  print(vf .. "\t\t" .. k)
+  done[vf] = true
+ end
+end
+os.execute("mkdir -p work/data/app-claw")
+os.execute("cp code/data/app-claw/local.lua work/data/app-claw/local.lua")
+os.execute("cp code/libs/sys-secpolicy.lua work/libs/sys-secpolicy.lua")
+os.execute("cd code ; find . > ../imitclaw.treecode")
+os.execute("cd work ; find . > ../imitclaw.treework")
+os.execute("diff -u imitclaw.treecode imitclaw.treework")
+os.execute("rm imitclaw.treecode imitclaw.treework")
diff --git a/package.sh b/package.sh
index d41b115..02cbc22 100755
--- a/package.sh
+++ b/package.sh
@@ -3,5 +3,7 @@
 # This is released into the public domain.
 # No warranty is provided, implied or otherwise.
 
-rm code.tar
-tar -cf code.tar code
+echo "WARNING: This will rm -rf the 'work' folder."
+# safety measure: unless we are likely in the right folder, DO NOT CONTINUE
+git status && stat imitclaw.lua code/apps/sys-init.lua && rm -rf work work.tar
+lua imitclaw.lua && tar -cf work.tar work
diff --git a/repository/app-eeprog.lua b/repository/apps/app-eeprog.lua
similarity index 100%
rename from repository/app-eeprog.lua
rename to repository/apps/app-eeprog.lua
diff --git a/repository/data/app-claw/local.lua b/repository/data/app-claw/local.lua
new file mode 100644
index 0000000..43a92b8
--- /dev/null
+++ b/repository/data/app-claw/local.lua
@@ -0,0 +1,16 @@
+return {
+ ["app-eeprog"] = {
+  desc = "EEPROM programmer / copier",
+  v = 0,
+  app = "app-eeprog",
+  deps = {
+   "neo"
+  },
+  dirs = {
+   "apps"
+  },
+  files = {
+   "apps/app-eeprog.lua"
+  },
+ }
+}
diff --git a/repository/list b/repository/list
deleted file mode 100644
index 669e29d..0000000
--- a/repository/list
+++ /dev/null
@@ -1,3 +0,0 @@
-app app-eeprog
-This flashes EEPROMs, an example of a package that does not come by default with KittenOS NEO.
-end